@livedesk/client 0.1.201 → 0.1.203

package/README.md

@@ -62,9 +62,9 @@ System Settings path when access is missing; after granting access, restart the
 client. When file transfer is enabled by the Hub, received files are saved
 to `Desktop/LiveDeskFiles` unless the Hub sets another destination folder.
 
-By default, the launcher uses the packaged C# RemoteFast engine when supported.
-It falls back to the Node engine for AI assist or when a compatible RemoteFast
-runtime is unavailable. Windows, macOS, and Linux all try RemoteFast first so
+By default, the launcher uses the packaged C# RemoteFast engine when supported.
+It falls back to the Node engine only when a compatible RemoteFast runtime is
+unavailable. Windows, macOS, and Linux all try RemoteFast first so
 the Hub can request the Mode 3 hardware video path when it is available.
 RemoteFast is shipped as a platform-specific self-contained .NET executable,
 so client computers do not need a separate .NET installation.

package/bin/livedesk-client-node.js

@@ -1552,7 +1552,7 @@ function remotePolicyAllows(options, command) {
 
 function buildClientUpdateBootstrapScript() {
     return [
-        'const { spawn } = require("node:child_process");',
+        'const { execFile, spawn } = require("node:child_process");',
         'const fs = require("node:fs");',
         'const path = require("node:path");',
         'const operationId = String(process.env.LIVEDESK_CLIENT_UPDATE_OPERATION_ID || "").trim();',
@@ -1569,15 +1569,29 @@ function buildClientUpdateBootstrapScript() {
         'const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));',
         'const isAlive = pid => { try { process.kill(pid, 0); return true; } catch (error) { return error?.code === "EPERM"; } };',
         'const isGroupAlive = pid => { try { process.kill(-pid, 0); return true; } catch (error) { return error?.code === "EPERM"; } };',
+        'const runWindowsPowerShell = script => new Promise((resolve, reject) => { execFile("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script], { windowsHide: true, timeout: 15000, killSignal: "SIGKILL", maxBuffer: 4 * 1024 * 1024 }, (error, stdout, stderr) => { if (error) { reject(new Error(String(stderr || error.message || "PowerShell failed").trim())); return; } resolve(String(stdout || "").trim()); }); });',
+        'const queryWindowsProcessTable = async () => { const stdout = await runWindowsPowerShell(`$ErrorActionPreference = "Stop"; $records = @(Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate | ForEach-Object { $ticks = if ($_.CreationDate) { [string]$_.CreationDate.ToUniversalTime().Ticks } else { "" }; [pscustomobject]@{ ProcessId = [int]$_.ProcessId; ParentProcessId = [int]$_.ParentProcessId; CreationUtcTicks = $ticks } }); [pscustomobject]@{ Records = $records } | ConvertTo-Json -Compress -Depth 4`); if (!stdout) throw new Error("Windows process snapshot returned no data"); const parsed = JSON.parse(stdout); const values = parsed?.Records == null ? [] : (Array.isArray(parsed.Records) ? parsed.Records : [parsed.Records]); return values.map(item => ({ pid: Number(item?.ProcessId || 0), parentPid: Number(item?.ParentProcessId || 0), startOrder: String(item?.CreationUtcTicks || "") })).filter(item => Number.isInteger(item.pid) && item.pid > 1 && /^\\d+$/.test(item.startOrder)); };',
+        'const queryTrackedWindowsProcessTable = child => { if (child.livedeskWindowsSnapshotPromise) return child.livedeskWindowsSnapshotPromise; const pending = queryWindowsProcessTable(); child.livedeskWindowsSnapshotPromise = pending; const clear = () => { if (child.livedeskWindowsSnapshotPromise === pending) child.livedeskWindowsSnapshotPromise = null; }; pending.then(clear, clear); return pending; };',
+        'const sameWindowsIdentity = (left, right) => Number(left?.pid || 0) === Number(right?.pid || 0) && String(left?.startOrder || "") === String(right?.startOrder || "");',
+        'const captureWindowsIdentity = async child => { const processId = Number(child?.pid || 0); const deadline = Date.now() + 2500; let lastError = null; do { try { const snapshot = await queryTrackedWindowsProcessTable(child); const identity = snapshot.find(item => item.pid === processId) || null; if (identity) return identity; } catch (error) { lastError = error; } if (Date.now() < deadline) await sleep(50); } while (Date.now() < deadline); throw new Error(`Could not capture immutable Windows CreationDate for pid=${processId}: ${lastError?.message || "process not visible"}`); };',
+        'const windowsTicksAtMilliseconds = value => BigInt(Math.trunc(Number(value) || Date.now())) * 10000n + 621355968000000000n;',
+        'const setWindowsRootLifetimeEnd = (child, ticks) => { const candidate = BigInt(ticks); const previous = child.livedeskWindowsRootLifetimeEndTicks; if (!previous || candidate < BigInt(previous)) child.livedeskWindowsRootLifetimeEndTicks = String(candidate); return BigInt(child.livedeskWindowsRootLifetimeEndTicks); };',
+        'const mergeRootAbsentWindowsTree = (child, rootPid, snapshot) => { const tracked = child.livedeskWindowsTrackedRecords || (child.livedeskWindowsTrackedRecords = new Map()); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const exactCurrentByPid = new Map(); for (const record of tracked.values()) { const current = currentByPid.get(record.pid); if (sameWindowsIdentity(current, record)) exactCurrentByPid.set(record.pid, record); } const lowerBound = windowsTicksAtMilliseconds(Number(child.livedeskWindowsSpawnedAtMs || Date.now()) - 2000); const upperBound = child.livedeskWindowsRootLifetimeEndTicks ? BigInt(child.livedeskWindowsRootLifetimeEndTicks) : null; let changed = true; while (changed) { changed = false; for (const record of snapshot) { const key = `${record.pid}:${record.startOrder}`; if (record.pid === rootPid || tracked.has(key)) continue; let recordStart; try { recordStart = BigInt(record.startOrder); if (recordStart < lowerBound || (upperBound && recordStart > upperBound)) continue; } catch { continue; } const parent = record.parentPid === rootPid ? { depth: 0 } : exactCurrentByPid.get(record.parentPid); if (!parent) continue; const descendant = { ...record, depth: Number(parent.depth || 0) + 1 }; tracked.set(key, descendant); exactCurrentByPid.set(descendant.pid, descendant); changed = true; } } return tracked; };',
+        'const mergeExactWindowsTree = (child, root, snapshot) => { const tracked = child.livedeskWindowsTrackedRecords || (child.livedeskWindowsTrackedRecords = new Map()); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const currentRoot = currentByPid.get(root.pid) || null; const rootIsExact = sameWindowsIdentity(currentRoot, root); const rootWasReused = Boolean(currentRoot && !rootIsExact); if (rootWasReused) setWindowsRootLifetimeEnd(child, BigInt(currentRoot.startOrder) - 1n); else if (!currentRoot && child.livedeskWindowsRootExitedAtMs) setWindowsRootLifetimeEnd(child, windowsTicksAtMilliseconds(child.livedeskWindowsRootExitedAtMs)); const rootLifetimeClosed = Boolean(child.livedeskWindowsRootLifetimeEndTicks); if (rootIsExact) tracked.set(`${root.pid}:${root.startOrder}`, { ...root, depth: 0 }); const exactCurrentByPid = new Map(); if (rootIsExact) exactCurrentByPid.set(root.pid, { ...root, depth: 0 }); for (const record of tracked.values()) { const current = currentByPid.get(record.pid); if (sameWindowsIdentity(current, record)) exactCurrentByPid.set(record.pid, record); } let changed = true; while (changed) { changed = false; for (const record of snapshot) { const key = `${record.pid}:${record.startOrder}`; if (record.pid === root.pid || tracked.has(key)) continue; let recordStart; try { recordStart = BigInt(record.startOrder); if (recordStart < BigInt(root.startOrder)) continue; if (rootLifetimeClosed && recordStart > BigInt(child.livedeskWindowsRootLifetimeEndTicks)) continue; } catch { continue; } let parent = exactCurrentByPid.get(record.parentPid) || null; if (!parent && !currentRoot && rootLifetimeClosed && record.parentPid === root.pid) parent = { ...root, depth: 0 }; if (!parent) continue; const descendant = { ...record, depth: Number(parent.depth || 0) + 1 }; tracked.set(key, descendant); exactCurrentByPid.set(descendant.pid, descendant); changed = true; } } return tracked; };',
+        'const refreshTrackedWindowsTree = async (child, root = child.livedeskWindowsIdentity || null) => { const snapshot = await queryTrackedWindowsProcessTable(child); if (root) mergeExactWindowsTree(child, root, snapshot); else mergeRootAbsentWindowsTree(child, Number(child.pid || 0), snapshot); return snapshot; };',
+        'const stopExactWindowsRecords = async records => { if (!Array.isArray(records) || records.length === 0) return; const encoded = Buffer.from(JSON.stringify(records.map(record => ({ pid: record.pid, startOrder: record.startOrder }))), "utf8").toString("base64"); const script = `$ErrorActionPreference = "Stop"; $targetsJson = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("${encoded}")); $targets = ConvertFrom-Json -InputObject $targetsJson; $failures = [System.Collections.Generic.List[string]]::new(); foreach ($item in $targets) { $targetPid = [int]$item.pid; $expectedStartTicks = [string]$item.startOrder; try { $target = Get-CimInstance Win32_Process -Filter "ProcessId = $targetPid" -Property ProcessId,CreationDate -ErrorAction SilentlyContinue | Select-Object -First 1; if (-not $target) { continue }; $targetStartTicks = if ($target.CreationDate) { [string]$target.CreationDate.ToUniversalTime().Ticks } else { "" }; if ($targetStartTicks -ne $expectedStartTicks) { continue }; Stop-Process -Id $targetPid -Force -ErrorAction Stop } catch { $failures.Add("pid=$targetPid $($_.Exception.Message)") } }; if ($failures.Count -gt 0) { [Console]::Error.WriteLine(($failures -join "; ")); exit 1 }`; await runWindowsPowerShell(script); };',
+        'const trackWindowsChild = child => { if (process.platform !== "win32" || Number(child?.pid || 0) <= 1 || child.livedeskWindowsIdentityPromise) return; child.livedeskWindowsTrackedRecords = new Map(); child.livedeskWindowsSpawnedAtMs = Date.now(); child.livedeskWindowsRootExitedAtMs = null; child.livedeskWindowsTrackingStopped = false; child.once("exit", () => { if (!child.livedeskWindowsRootExitedAtMs) child.livedeskWindowsRootExitedAtMs = Date.now(); setWindowsRootLifetimeEnd(child, windowsTicksAtMilliseconds(child.livedeskWindowsRootExitedAtMs)); }); const refresh = () => { void refreshTrackedWindowsTree(child).then(() => { child.livedeskWindowsTrackingError = null; }).catch(error => { child.livedeskWindowsTrackingError = error; }); }; refresh(); child.livedeskWindowsTrackingTimer = setInterval(refresh, 250); child.livedeskWindowsTrackingTimer.unref?.(); child.livedeskWindowsIdentityPromise = (async () => { while (!child.livedeskWindowsTrackingStopped && !child.livedeskWindowsRootExitedAtMs) { try { const identity = await captureWindowsIdentity(child); child.livedeskWindowsIdentity = identity; refresh(); return identity; } catch (error) { child.livedeskWindowsIdentityError = error; if (!child.livedeskWindowsTrackingStopped && !child.livedeskWindowsRootExitedAtMs) await sleep(250); } } return null; })(); };',
+        'const stopWindowsTracking = child => { child.livedeskWindowsTrackingStopped = true; if (child?.livedeskWindowsTrackingTimer) clearInterval(child.livedeskWindowsTrackingTimer); child.livedeskWindowsTrackingTimer = null; };',
+        'const terminateExactWindowsTrackedTree = (child, root) => { if (child.livedeskWindowsDrainPromise) return child.livedeskWindowsDrainPromise; child.livedeskWindowsDrainPromise = (async () => { let attempt = 0; let emptyPasses = 0; for (;;) { attempt += 1; try { const snapshot = await refreshTrackedWindowsTree(child, root); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const remaining = [...child.livedeskWindowsTrackedRecords.values()].filter(target => sameWindowsIdentity(currentByPid.get(target.pid), target)).sort((left, right) => Number(right.depth || 0) - Number(left.depth || 0)); if (remaining.length === 0) { emptyPasses += 1; if (emptyPasses >= 2) { stopWindowsTracking(child); return; } } else { emptyPasses = 0; await stopExactWindowsRecords(remaining); } child.livedeskWindowsTrackingError = null; } catch (error) { emptyPasses = 0; child.livedeskWindowsTrackingError = error; if (attempt === 1 || attempt % 10 === 0) process.stderr.write(`LiveDesk update cleanup is retrying exact Windows process-tree drain: ${error?.message || error}\\n`); } await sleep(Math.min(1000, 100 + (attempt * 50))); } })(); return child.livedeskWindowsDrainPromise; };',
         'const stateLockPath = statePath + ".lock"; const lockWaitBuffer = new Int32Array(new SharedArrayBuffer(4));',
         'const waitForStateLock = ms => Atomics.wait(lockWaitBuffer, 0, 0, Math.max(1, ms));',
         'const removeAbandonedStateLock = () => { let owner = null; try { owner = JSON.parse(fs.readFileSync(stateLockPath, "utf8")); } catch {} const ownerPid = Number(owner?.pid || 0); if (Number.isInteger(ownerPid) && ownerPid > 1) { if (isAlive(ownerPid)) return false; } else { try { if (Date.now() - fs.statSync(stateLockPath).mtimeMs < 5000) return false; } catch { return true; } } try { fs.rmSync(stateLockPath); return true; } catch { return false; } };',
         'const withStateLock = callback => { fs.mkdirSync(path.dirname(stateLockPath), { recursive: true }); const deadline = Date.now() + 10000; let descriptor = null; let token = ""; while (descriptor === null) { try { descriptor = fs.openSync(stateLockPath, "wx", 0o600); token = process.pid + "-" + Date.now() + "-" + Math.random().toString(16).slice(2); fs.writeFileSync(descriptor, JSON.stringify({ pid: process.pid, token, acquiredAt: new Date().toISOString() }), "utf8"); } catch (error) { if (descriptor !== null) { try { fs.closeSync(descriptor); } catch {} descriptor = null; try { fs.rmSync(stateLockPath, { force: true }); } catch {} } if (error?.code !== "EEXIST") throw error; if (removeAbandonedStateLock()) continue; if (Date.now() >= deadline) throw new Error("Timed out waiting for the LiveDesk update state lock: " + stateLockPath); waitForStateLock(Math.min(25, Math.max(1, deadline - Date.now()))); } } try { return callback(); } finally { try { fs.closeSync(descriptor); } catch {} try { const owner = JSON.parse(fs.readFileSync(stateLockPath, "utf8")); if (owner?.token === token && Number(owner?.pid) === process.pid) fs.rmSync(stateLockPath, { force: true }); } catch {} } };',
         'const writeFailure = (error, cancelRequested = false) => { try { withStateLock(() => { const previous = readState(); if (previous.operationId && previous.operationId !== operationId) return; if (previous.stage === "preflight-ready" || previous.stage === "waiting-for-shutdown" || previous.stage === "connected" || previous.stage === "restored") return; const now = new Date().toISOString(); const next = { ...previous, operationId, stage: "failed", targetProductVersion, restartVerified: false, cancelRequested: cancelRequested || previous.cancelRequested === true, error: String(error?.message || error).slice(0, 4000), failedAt: now, updatedAt: now }; const temporary = statePath + "." + process.pid + ".handoff.tmp"; fs.writeFileSync(temporary, JSON.stringify(next, null, 2), { encoding: "utf8", mode: 0o600 }); fs.renameSync(temporary, statePath); }); } catch {} process.stderr.write("LiveDesk update handoff failed: " + (error?.message || error) + "\\n"); process.exitCode = 1; };',
         'const writeCancellation = error => withStateLock(() => { const previous = readState(); if (previous.operationId && previous.operationId !== operationId) return "superseded"; if (previous.operationId !== operationId) return false; if (previous.stage === "preflight-ready" || previous.stage === "waiting-for-shutdown") return "ready"; if (previous.stage === "failed") return previous.cancelRequested === true ? "cancelled" : "failed"; const now = new Date().toISOString(); const next = { ...previous, operationId, stage: "failed", targetProductVersion, restartVerified: false, cancelRequested: true, error: String(error?.message || error).slice(0, 4000), cancelledAt: now, failedAt: now, updatedAt: now }; const temporary = statePath + "." + process.pid + ".cancel.tmp"; fs.writeFileSync(temporary, JSON.stringify(next, null, 2), { encoding: "utf8", mode: 0o600 }); fs.renameSync(temporary, statePath); return "cancelled"; });',
-        'const terminateTree = async child => { const pid = Number(child?.pid || 0); if (pid <= 1) return; if (process.platform === "win32") { await new Promise(resolve => { const killer = spawn("taskkill.exe", ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" }); let done = false; const finish = () => { if (done) return; done = true; clearTimeout(timer); resolve(); }; const timer = setTimeout(() => { try { killer.kill("SIGKILL"); } catch {} finish(); }, 10000); killer.once("error", finish); killer.once("exit", finish); }); if (isAlive(pid)) { try { child.kill("SIGKILL"); } catch {} } return; } try { process.kill(-pid, "SIGTERM"); } catch { try { child.kill("SIGTERM"); } catch {} } const gracefulDeadline = Date.now() + 2000; while (Date.now() < gracefulDeadline && (isGroupAlive(pid) || isAlive(pid))) await sleep(100); if (isGroupAlive(pid) || isAlive(pid)) { try { process.kill(-pid, "SIGKILL"); } catch { try { child.kill("SIGKILL"); } catch {} } } };',
+        'const terminateTree = async child => { const pid = Number(child?.pid || 0); if (pid <= 1) return; if (process.platform === "win32") { const root = child.livedeskWindowsIdentity || await child.livedeskWindowsIdentityPromise; if (!root && !child.livedeskWindowsRootExitedAtMs) { child.livedeskWindowsTrackingError = child.livedeskWindowsIdentityError || new Error(`No immutable Windows identity is available for pid=${pid}`); while (!child.livedeskWindowsRootExitedAtMs && !child.livedeskWindowsIdentity) await sleep(250); } await terminateExactWindowsTrackedTree(child, child.livedeskWindowsIdentity || root || null); return; } try { process.kill(-pid, "SIGTERM"); } catch { try { child.kill("SIGTERM"); } catch {} } const gracefulDeadline = Date.now() + 2000; while (Date.now() < gracefulDeadline && (isGroupAlive(pid) || isAlive(pid))) await sleep(100); if (isGroupAlive(pid) || isAlive(pid)) { try { process.kill(-pid, "SIGKILL"); } catch { try { child.kill("SIGKILL"); } catch {} } } };',
         'const writeHandoffStarted = () => withStateLock(() => { if (deadlineExpired()) throw new Error("The absolute LiveDesk Client update deadline expired before handoff."); const previous = readState(); if (previous.operationId !== operationId) throw new Error("LiveDesk update handoff was superseded before exact-package launch."); const now = new Date().toISOString(); const next = { ...previous, operationId, stage: "handoff-started", starterPid: process.pid, updateDeadlineEpochMs, restartVerified: false, error: "", updatedAt: now }; const temporary = statePath + "." + process.pid + ".handoff-started.tmp"; fs.writeFileSync(temporary, JSON.stringify(next, null, 2), { encoding: "utf8", mode: 0o600 }); fs.renameSync(temporary, statePath); });',
-        'const monitorPreflight = child => { let settled = false; const finish = (error, preserveFailure = false) => { if (settled) return; settled = true; clearInterval(poll); clearTimeout(timeout); child.unref(); if (preserveFailure) process.exitCode = 1; else if (error) writeFailure(error); }; const inspect = () => { const state = readState(); if (state.operationId !== operationId) return; if (state.stage === "preflight-ready" || state.stage === "waiting-for-shutdown") finish(); else if (state.stage === "failed") finish(null, true); }; const cancelTimedOutHandoff = async () => { const error = new Error(deadlineExpired() ? "The absolute LiveDesk Client update deadline expired before exact-package preflight." : "Timed out waiting for exact-package update preflight."); while (!settled) { inspect(); if (settled) return; let outcome; try { outcome = writeCancellation(error); } catch (lockError) { finish(lockError); return; } if (outcome === "ready" || outcome === "failed") { inspect(); if (settled) return; } else if (outcome === "cancelled" || outcome === "superseded") { await terminateTree(child); finish(null, true); return; } await sleep(25); } }; const poll = setInterval(inspect, 100); const timeoutMs = Math.max(1, Math.min(Math.max(1000, Number(process.env.LIVEDESK_CLIENT_UPDATE_HANDOFF_TIMEOUT_MS || 140000)), updateDeadlineEpochMs - Date.now())); const timeout = setTimeout(() => { void cancelTimedOutHandoff(); }, timeoutMs); child.once("exit", (code, signal) => { inspect(); if (!settled) finish(new Error("Exact-package update supervisor exited before preflight (code=" + (code ?? "none") + ", signal=" + (signal || "none") + ").")); }); inspect(); };',
+        'const monitorPreflight = child => { let settled = false; let draining = false; let drainPromise = null; const finish = (error, preserveFailure = false) => { if (settled) return; settled = true; clearInterval(poll); clearTimeout(timeout); stopWindowsTracking(child); child.unref(); if (preserveFailure) process.exitCode = 1; else if (error) writeFailure(error); }; const drainAndFinish = (error, preserveFailure = false) => { if (settled) return Promise.resolve(); draining = true; if (!drainPromise) drainPromise = terminateTree(child).then(() => finish(error, preserveFailure)); return drainPromise; }; const inspect = () => { if (draining) return; const state = readState(); if (state.operationId !== operationId) return; if (state.stage === "preflight-ready" || state.stage === "waiting-for-shutdown") finish(); else if (state.stage === "failed") void drainAndFinish(null, true); }; const cancelTimedOutHandoff = async () => { const error = new Error(deadlineExpired() ? "The absolute LiveDesk Client update deadline expired before exact-package preflight." : "Timed out waiting for exact-package update preflight."); draining = true; while (!settled) { let outcome; try { outcome = writeCancellation(error); } catch (lockError) { await drainAndFinish(lockError); return; } if (outcome === "ready") { draining = false; inspect(); return; } if (outcome === "failed" || outcome === "cancelled" || outcome === "superseded") { await drainAndFinish(null, true); return; } await sleep(25); } }; const poll = setInterval(inspect, 100); const timeoutMs = Math.max(1, Math.min(Math.max(1000, Number(process.env.LIVEDESK_CLIENT_UPDATE_HANDOFF_TIMEOUT_MS || 140000)), updateDeadlineEpochMs - Date.now())); const timeout = setTimeout(() => { void cancelTimedOutHandoff().catch(error => { void drainAndFinish(error); }); }, timeoutMs); child.once("exit", (code, signal) => { inspect(); if (settled || draining) return; const error = new Error("Exact-package update supervisor exited before preflight (code=" + (code ?? "none") + ", signal=" + (signal || "none") + ")."); void drainAndFinish(error); }); inspect(); };',
         'const prepareNeutralCwd = () => { if (!neutralCwd) throw new Error("LiveDesk update neutral working directory is unavailable"); fs.mkdirSync(neutralCwd, { recursive: true }); const unexpectedEntry = fs.readdirSync(neutralCwd)[0]; if (unexpectedEntry) { const shadow = path.join(neutralCwd, unexpectedEntry); throw new Error("LiveDesk update neutral working directory is shadowed by " + shadow + ": " + neutralCwd); } };',
         'if (!operationId || !versionPattern.test(targetProductVersion) || deadlineExpired()) { writeFailure(new Error("Invalid or expired LiveDesk exact-package update handoff."), true); } else { try { prepareNeutralCwd(); writeHandoffStarted();',
         'const env = { ...process.env, LIVEDESK_UPDATE_STARTER_PID: String(process.pid) }; const isolated = new Set(["init_cwd", "npm_config_local_prefix", "npm_config_workspace", "npm_config_workspaces", "npm_config_include_workspace_root", "npm_package_json", "npm_lifecycle_event", "npm_lifecycle_script"]); for (const key of Object.keys(env)) if (isolated.has(key.toLowerCase())) delete env[key]; env.INIT_CWD = neutralCwd; env.npm_config_local_prefix = neutralCwd; env.npm_config_workspaces = "false"; env.npm_config_include_workspace_root = "false";',
@@ -1587,7 +1601,7 @@ function buildClientUpdateBootstrapScript() {
         'const args = ["-y", "--prefer-online", "--prefix", neutralCwd, "--workspaces=false", "livedesk@" + targetProductVersion, "--internal-legacy-client-update"];',
         'const quoteCmd = value => "\\"" + String(value).replaceAll("%", "%%").replaceAll("\\"", "\\"\\"") + "\\"";',
         'const invocation = npxCli ? { command: process.execPath, args: [npxCli, ...args] } : process.platform === "win32" ? { command: env.ComSpec || "cmd.exe", args: ["/d", "/s", "/c", "call " + quoteCmd(npx) + " " + args.map(quoteCmd).join(" ")] } : { command: npx, args };',
-        'if (!npxCli && path.isAbsolute(npx) && !fs.existsSync(npx)) { writeFailure(new Error("LiveDesk npx executable was not found: " + npx)); } else { try { const child = spawn(invocation.command, invocation.args, { cwd: neutralCwd, env, detached: true, stdio: "ignore", windowsHide: true }); child.once("error", writeFailure); child.once("spawn", () => monitorPreflight(child)); } catch (error) { writeFailure(error); } }',
+        'if (!npxCli && path.isAbsolute(npx) && !fs.existsSync(npx)) { writeFailure(new Error("LiveDesk npx executable was not found: " + npx)); } else { try { const child = spawn(invocation.command, invocation.args, { cwd: neutralCwd, env, detached: true, stdio: "ignore", windowsHide: true }); trackWindowsChild(child); child.once("error", writeFailure); child.once("spawn", () => { trackWindowsChild(child); monitorPreflight(child); }); } catch (error) { writeFailure(error); } }',
         '} catch (error) { writeFailure(error, deadlineExpired()); } }',
         ''
     ].join('\n');

package/bin/livedesk-client.js

@@ -18,6 +18,7 @@ import {
     installAgentTerminationHandlers,
     signalAgentTree
 } from '../src/runtime/agent-process-lifecycle.js';
+import { writeWindowsOwnedProcessManifest } from '../src/runtime/windows-owned-process-manifest.js';
 import { createHubWakeListener } from '../src/runtime/hub-wake-listener.js';
 import {
     inspectLinuxVideoAcceleration,
@@ -73,7 +74,69 @@ let linuxVideoAccelerationStatus = null;
 let discoveryWakeController = new AbortController();
 let networkChangeMonitor = null;
 const sessionRefreshesInFlight = new WeakMap();
-installAgentTerminationHandlers({ getAgentProcess: () => activeAgentProcess });
+const disposeAgentTerminationHandlers = installAgentTerminationHandlers({
+    getAgentProcess: () => activeAgentProcess
+});
+
+function readWindowsManifestOwnerFromEnvironment(env = process.env) {
+    if (process.platform !== 'win32') return null;
+    const rawOwner = {
+        pid: String(env.LIVEDESK_RUNTIME_OWNER_PID || '').trim(),
+        ownerToken: String(env.LIVEDESK_RUNTIME_OWNER_TOKEN || '').trim(),
+        ownerInstanceMarker: String(env.LIVEDESK_RUNTIME_OWNER_INSTANCE_MARKER || '').trim(),
+        ownerStartOrder: String(env.LIVEDESK_RUNTIME_OWNER_START_ORDER || '').trim()
+    };
+    const hasAnyOwnerField = Object.values(rawOwner).some(Boolean);
+    if (!hasAnyOwnerField) return null;
+    const owner = {
+        ...rawOwner,
+        pid: Number(rawOwner.pid)
+    };
+    if (owner.pid !== process.pid
+        || !/^[a-f0-9]{32}$/i.test(owner.ownerToken)
+        || !owner.ownerInstanceMarker.startsWith(`${process.pid}:`)
+        || !/^\d+$/.test(owner.ownerStartOrder)) {
+        console.warn(
+            '[LiveDesk Client] Windows process-manifest publication is disabled because '
+            + 'the unified launcher owner tuple is incomplete or does not name this exact process.'
+        );
+        return null;
+    }
+    return owner;
+}
+
+const WINDOWS_PROCESS_MANIFEST_OWNER = readWindowsManifestOwnerFromEnvironment();
+
+function publishWindowsOwnedAgentRecords(records, {
+    rootRecord,
+    snapshot
+} = {}) {
+    if (!WINDOWS_PROCESS_MANIFEST_OWNER || !rootRecord || records.length === 0) return;
+    const ownerRecord = (Array.isArray(snapshot) ? snapshot : []).find(
+        record => Number(record?.pid || 0) === WINDOWS_PROCESS_MANIFEST_OWNER.pid
+    );
+    const exactOwnerGeneration = ownerRecord
+        && ownerRecord.startOrder === WINDOWS_PROCESS_MANIFEST_OWNER.ownerStartOrder
+        && `${ownerRecord.pid}:${ownerRecord.startMarker}`
+            === WINDOWS_PROCESS_MANIFEST_OWNER.ownerInstanceMarker;
+    if (!exactOwnerGeneration) {
+        throw new Error(
+            'The Windows process snapshot did not confirm the unified launcher owner generation.'
+        );
+    }
+    const publication = writeWindowsOwnedProcessManifest({
+        stateDir: UNIFIED_CLIENT_STATE_DIR,
+        owner: WINDOWS_PROCESS_MANIFEST_OWNER,
+        records
+    });
+    if (!publication.ok) {
+        throw publication.error || new Error('Windows owned-process manifest publication failed.');
+    }
+}
+
+export function requestClientRuntimeShutdown(signal = 'SIGTERM') {
+    disposeAgentTerminationHandlers.requestTermination(signal);
+}
 
 function requestActiveAgentStop(signal = 'SIGTERM') {
     const child = activeAgentProcess;
@@ -3233,8 +3296,8 @@ async function chooseClientConnection(supabase, options = {}) {
                 }, 150);
                 return { ...result, slotNumber, saved: true, restarting: true };
             },
-            onRestart: () => process.kill(process.pid, 'SIGTERM'),
-            onShutdown: () => process.kill(process.pid, 'SIGTERM'),
+            onRestart: () => requestClientRuntimeShutdown('SIGTERM'),
+            onShutdown: () => requestClientRuntimeShutdown('SIGTERM'),
             onDisconnect: () => requestActiveAgentStop(),
             // Ending the current Agent causes the unified lifecycle loop to
             // discard its old manager/pair token and start Supabase discovery
@@ -4308,7 +4371,10 @@ function spawnAgent(command, args, env = process.env, onStart = null) {
     });
     child.livedeskOwnsProcessGroup = ownsProcessGroup;
     child.livedeskWindowsTreeTracker = createWindowsProcessTreeTracker(child, {
-        spawnedAtMs: agentSpawnedAtMs
+        spawnedAtMs: agentSpawnedAtMs,
+        publishTrackedRecords: WINDOWS_PROCESS_MANIFEST_OWNER
+            ? publishWindowsOwnedAgentRecords
+            : null
     });
     activeAgentProcess = child;
     if (typeof onStart === 'function') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.201",
+  "version": "0.1.203",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {
@@ -41,10 +41,10 @@
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.409",
-    "@livedesk/fast-osx-arm64": "0.1.409",
-    "@livedesk/fast-osx-x64": "0.1.409",
-    "@livedesk/fast-win-x64": "0.1.409"
+    "@livedesk/fast-linux-x64": "0.1.411",
+    "@livedesk/fast-osx-arm64": "0.1.411",
+    "@livedesk/fast-osx-x64": "0.1.411",
+    "@livedesk/fast-win-x64": "0.1.411"
   },
   "publishConfig": {
     "access": "public"

package/src/runtime/agent-process-lifecycle.js

@@ -30,6 +30,14 @@ function windowsTicksForUnixMilliseconds(milliseconds) {
     return BigInt(Math.trunc(Number(milliseconds) || 0)) * 10_000n + 621_355_968_000_000_000n;
 }
 
+function unixMillisecondsForWindowsTicks(ticks) {
+    try {
+        return Number((BigInt(ticks) - 621_355_968_000_000_000n) / 10_000n);
+    } catch {
+        return 0;
+    }
+}
+
 function windowsRecordIsWithinLifetime(record, spawnedAtMs, exitedAtMs = null) {
     if (!record?.startOrder) return false;
     try {
@@ -72,7 +80,7 @@ export async function queryWindowsProcessTable({
 } = {}) {
     const script = [
         '$ErrorActionPreference = "Stop";',
-        '@(Get-CimInstance Win32_Process | ForEach-Object {',
+        '@(Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate | ForEach-Object {',
         '  $creation = [string]$_.CreationDate;',
         '  $ticks = if ($_.CreationDate) { [string]$_.CreationDate.ToUniversalTime().Ticks } else { "" };',
         '  [pscustomobject]@{ ProcessId = [int]$_.ProcessId; ParentProcessId = [int]$_.ParentProcessId; CreationDate = $creation; CreationUtcTicks = $ticks }',
@@ -102,31 +110,42 @@ export async function queryWindowsProcessTable({
 }
 
 /**
- * Rechecks CreationDate inside the same PowerShell process immediately before
- * taskkill. PID reuse therefore becomes a harmless identity mismatch instead
- * of terminating the replacement process.
+ * Rechecks CreationDate and force-stops the single PID inside the same
+ * PowerShell process. PID reuse therefore becomes a harmless identity mismatch
+ * instead of terminating the replacement process.
  */
-export async function terminateExactWindowsProcessTree(record, {
-    includeTree = true,
+export async function terminateExactWindowsProcessTree(recordOrRecords, {
     execFileImpl = execFile
 } = {}) {
-    const target = normalizeWindowsProcessRecord(record);
-    if (!target) {
-        return { ok: false, error: new Error('An immutable Windows process record is required.') };
+    const targets = (Array.isArray(recordOrRecords) ? recordOrRecords : [recordOrRecords])
+        .map(normalizeWindowsProcessRecord)
+        .filter(Boolean);
+    if (targets.length === 0) {
+        return { ok: false, error: new Error('At least one immutable Windows process record is required.') };
     }
-    const expectedStartTicks = target.startOrder;
-    const treeArgument = includeTree ? ', "/T"' : '';
+    const targetsJson = JSON.stringify(targets.map(target => ({
+        pid: target.pid,
+        startOrder: target.startOrder
+    }))).replaceAll("'", "''");
     const script = [
         '$ErrorActionPreference = "Stop";',
-        `$targetPid = ${target.pid};`,
-        `$expectedStartTicks = '${expectedStartTicks}';`,
-        '$target = Get-CimInstance Win32_Process -Filter "ProcessId = $targetPid" -ErrorAction SilentlyContinue | Select-Object -First 1;',
-        'if (-not $target) { exit 0 };',
-        '$targetStartTicks = if ($target.CreationDate) { [string]$target.CreationDate.ToUniversalTime().Ticks } else { "" };',
-        'if ($targetStartTicks -ne $expectedStartTicks) { exit 0 };',
-        `$arguments = @("/PID", [string]$targetPid${treeArgument}, "/F");`,
-        '$taskkill = Start-Process -FilePath "taskkill.exe" -ArgumentList $arguments -NoNewWindow -Wait -PassThru;',
-        'exit $taskkill.ExitCode'
+        `$targets = ConvertFrom-Json -InputObject '${targetsJson}';`,
+        '$failures = [System.Collections.Generic.List[string]]::new();',
+        'foreach ($item in $targets) {',
+        '  $targetPid = [int]$item.pid;',
+        '  $expectedStartTicks = [string]$item.startOrder;',
+        '  try {',
+        '    $target = Get-CimInstance Win32_Process -Filter "ProcessId = $targetPid" -Property ProcessId,CreationDate -ErrorAction SilentlyContinue | Select-Object -First 1;',
+        '    if (-not $target) { continue };',
+        '    $targetStartTicks = if ($target.CreationDate) { [string]$target.CreationDate.ToUniversalTime().Ticks } else { "" };',
+        '    if ($targetStartTicks -ne $expectedStartTicks) { continue };',
+        '    Stop-Process -Id $targetPid -Force -ErrorAction Stop;',
+        '  } catch {',
+        '    $failures.Add("pid=$targetPid $($_.Exception.Message)");',
+        '  }',
+        '}',
+        'if ($failures.Count -gt 0) { [Console]::Error.WriteLine(($failures -join "; ")); exit 1 };',
+        'exit 0;'
     ].join(' ');
     return runExecFile(
         'powershell.exe',
@@ -148,7 +167,11 @@ export function createWindowsProcessTreeTracker(child, {
     snapshotIntervalMs = DEFAULT_WINDOWS_TREE_SNAPSHOT_MS,
     spawnedAtMs = Date.now(),
     setIntervalImpl = setInterval,
-    clearIntervalImpl = clearInterval
+    clearIntervalImpl = clearInterval,
+    publishTrackedRecords = null,
+    reportPublisherError = error => console.warn(
+        `[LiveDesk Client] Windows owned-process manifest warning: ${error?.message || error}`
+    )
 } = {}) {
     const rootPid = Number(child?.pid || 0);
     const enabled = platform === 'win32' && Number.isInteger(rootPid) && rootPid > 1;
@@ -164,19 +187,33 @@ export function createWindowsProcessTreeTracker(child, {
     let lastSnapshotHadRootPid = false;
     let successfulSnapshotAfterExit = false;
     let ambiguousRootReuse = false;
+    let lastPublisherError = null;
 
     const mergeSnapshot = snapshot => {
         const records = (Array.isArray(snapshot) ? snapshot : [])
             .map(normalizeWindowsProcessRecord)
             .filter(Boolean);
         lastSnapshot = records;
-        if (rootExitedAtMs !== null) successfulSnapshotAfterExit = true;
         const currentByPid = new Map(records.map(record => [record.pid, record]));
         const currentRoot = currentByPid.get(rootPid) || null;
         lastSnapshotHadRootPid = Boolean(currentRoot);
-        if (rootRecord && currentRoot && !sameWindowsProcess(currentRoot, rootRecord)) {
+        const rootWasReused = Boolean(
+            rootRecord && currentRoot && !sameWindowsProcess(currentRoot, rootRecord)
+        );
+        if (rootWasReused) {
             ambiguousRootReuse = true;
         }
+        if (rootRecord && rootExitedAtMs === null && (!currentRoot || rootWasReused)) {
+            // The exit event can trail the first CIM snapshot that proves the
+            // exact root is gone. Use that proof immediately so a surviving
+            // child first observed in this same snapshot is still owned.
+            // For PID reuse, cap the old lifetime just before the replacement
+            // CreationDate so replacement-root children remain excluded.
+            rootExitedAtMs = rootWasReused
+                ? unixMillisecondsForWindowsTicks(currentRoot.startOrder) - 1
+                : Date.now();
+        }
+        if (rootExitedAtMs !== null) successfulSnapshotAfterExit = true;
         if (!rootRecord
             && currentRoot
             && windowsRecordIsWithinLifetime(currentRoot, spawnedAtMs, rootExitedAtMs)) {
@@ -202,9 +239,11 @@ export function createWindowsProcessTreeTracker(child, {
             }
         }
 
-        // If the root PID is absent, Windows retains ParentProcessId on its
-        // surviving direct children. If the PID has already been reused, do
-        // not infer any new lineage through that ambiguous numeric PID.
+        // Windows retains ParentProcessId on surviving direct children after
+        // the root exits. A reused root PID is also safe to bridge only for a
+        // direct child whose immutable creation time is inside the original
+        // root lifetime; children created by the replacement root are rejected
+        // by windowsRecordIsWithinLifetime.
         const rootAbsent = !currentRoot;
         let changed = true;
         while (changed) {
@@ -215,7 +254,7 @@ export function createWindowsProcessTreeTracker(child, {
                 let parent = exactCurrentByPid.get(record.parentPid) || null;
                 if (!parent
                     && rootExitedAtMs !== null
-                    && rootAbsent
+                    && (rootAbsent || rootWasReused)
                     && record.parentPid === rootPid) {
                     parent = rootRecord || { pid: rootPid, depth: 0 };
                 }
@@ -233,10 +272,34 @@ export function createWindowsProcessTreeTracker(child, {
         if (inFlight) return inFlight;
         inFlight = Promise.resolve()
             .then(() => queryProcessTableImpl())
-            .then(snapshot => {
+            .then(async snapshot => {
                 mergeSnapshot(snapshot);
                 lastError = null;
-                return { ok: true, records: lastSnapshot };
+                if (typeof publishTrackedRecords === 'function') {
+                    try {
+                        await publishTrackedRecords(
+                            [...tracked.values()].map(record => ({ ...record })),
+                            {
+                                rootPid,
+                                rootRecord: rootRecord ? { ...rootRecord } : null,
+                                snapshot: lastSnapshot.map(record => ({ ...record })),
+                                terminal: stopped
+                            }
+                        );
+                        lastPublisherError = null;
+                    } catch (error) {
+                        // Manifest publication must never break the in-memory
+                        // cleanup proof. Keep tracking, surface diagnostics,
+                        // and retry on the next cadence/terminal refresh.
+                        lastPublisherError = error;
+                        try { reportPublisherError(error); } catch { /* diagnostics cannot own lifecycle */ }
+                    }
+                }
+                return {
+                    ok: true,
+                    records: lastSnapshot,
+                    publisherError: lastPublisherError
+                };
             })
             .catch(error => {
                 lastError = error;
@@ -285,7 +348,8 @@ export function createWindowsProcessTreeTracker(child, {
                 .filter(record => sameWindowsProcess(currentByPid.get(record.pid), record))
                 .map(record => ({ ...record }));
         },
-        getLastError: () => lastError
+        getLastError: () => lastError,
+        getLastPublisherError: () => lastPublisherError
     };
 }
 
@@ -345,17 +409,18 @@ export async function drainOwnedWindowsAgentTree(child, {
             } else {
                 const remaining = tracker.getCurrentExactRecords();
                 if (remaining.length === 0
-                    && tracker.hasSafeFinalSnapshot?.()
-                    && !tracker.hasAmbiguousRootReuse?.()) {
+                    && tracker.hasSafeFinalSnapshot?.()) {
                     return { ok: true, remaining: [] };
                 }
                 const ordered = [...remaining].sort((left, right) => (
-                    Number(left.depth || 0) - Number(right.depth || 0)
+                    Number(right.depth || 0) - Number(left.depth || 0)
                 ));
-                for (const record of ordered) {
-                    const termination = await terminateExactTreeImpl(record, { includeTree: true });
-                    if (termination?.ok === false) lastError = termination.error || lastError;
-                }
+                // One PowerShell invocation receives the descendant-first
+                // immutable snapshot, then rechecks every PID CreationDate
+                // immediately before its own Stop-Process. No taskkill /T
+                // traversal can follow an unverified stale PPID edge.
+                const termination = await terminateExactTreeImpl(ordered, { includeTree: false });
+                if (termination?.ok === false) lastError = termination.error || lastError;
             }
             if (attempt < attempts) {
                 await waitImpl(Math.max(25, Number(retryMs) || 100));
@@ -366,8 +431,7 @@ export async function drainOwnedWindowsAgentTree(child, {
         const remaining = finalRefresh.ok ? tracker.getCurrentExactRecords() : tracker.getTrackedRecords();
         if (finalRefresh.ok
             && remaining.length === 0
-            && tracker.hasSafeFinalSnapshot?.()
-            && !tracker.hasAmbiguousRootReuse?.()) {
+            && tracker.hasSafeFinalSnapshot?.()) {
             return { ok: true, remaining: [] };
         }
         const error = finalRefresh.error || lastError || new Error(
@@ -717,9 +781,18 @@ export function installAgentTerminationHandlers({
         hostProcess.on(signal, handler);
     }
 
-    return () => {
+    const dispose = () => {
         for (const [signal, handler] of handlers) {
             hostProcess.removeListener(signal, handler);
         }
     };
+    // Windows process.kill(pid, 'SIGTERM') can terminate a process without
+    // dispatching its JavaScript SIGTERM listener. Replacement startup must
+    // enter this exact cleanup state machine directly instead of simulating an
+    // operating-system signal.
+    dispose.requestTermination = (signal = 'SIGTERM') => {
+        const normalizedSignal = signal === 'SIGINT' ? 'SIGINT' : 'SIGTERM';
+        handlers.get(normalizedSignal)?.();
+    };
+    return dispose;
 }

package/src/runtime/windows-owned-process-manifest.js

@@ -0,0 +1,235 @@
+import { randomBytes } from 'node:crypto';
+import {
+    chmodSync,
+    mkdirSync,
+    readFileSync,
+    renameSync,
+    unlinkSync,
+    writeFileSync
+} from 'node:fs';
+import { dirname, join } from 'node:path';
+import os from 'node:os';
+
+export const WINDOWS_OWNED_PROCESS_MANIFEST_VERSION = 1;
+export const DEFAULT_WINDOWS_OWNED_PROCESS_MANIFEST_MAX_AGE_MS = 30_000;
+
+const WINDOWS_OWNED_PROCESS_MANIFEST_FILE_NAME = 'client-owned-windows-processes.json';
+const MAX_FUTURE_CLOCK_SKEW_MS = 5_000;
+
+function resultError(message) {
+    return new Error(message);
+}
+
+function resolveNow(now) {
+    const value = typeof now === 'function' ? now() : now;
+    const milliseconds = value === undefined ? Date.now() : Number(value);
+    return Number.isFinite(milliseconds) ? milliseconds : NaN;
+}
+
+function normalizeOwner(value) {
+    const owner = {
+        pid: Number(value?.pid || 0),
+        ownerToken: String(value?.ownerToken || '').trim(),
+        ownerInstanceMarker: String(value?.ownerInstanceMarker || '').trim(),
+        ownerStartOrder: String(value?.ownerStartOrder || '').trim()
+    };
+    if (!Number.isInteger(owner.pid)
+        || owner.pid <= 1
+        || !/^[a-f0-9]{32}$/i.test(owner.ownerToken)
+        || !owner.ownerInstanceMarker.startsWith(`${owner.pid}:`)
+        || !/^\d+$/.test(owner.ownerStartOrder)) {
+        return null;
+    }
+    return owner;
+}
+
+function ownersMatch(leftValue, rightValue) {
+    const left = normalizeOwner(leftValue);
+    const right = normalizeOwner(rightValue);
+    return !!left
+        && !!right
+        && left.pid === right.pid
+        && left.ownerToken === right.ownerToken
+        && left.ownerInstanceMarker === right.ownerInstanceMarker
+        && left.ownerStartOrder === right.ownerStartOrder;
+}
+
+function normalizeRecord(value) {
+    const record = {
+        pid: Number(value?.pid ?? value?.ProcessId ?? 0),
+        parentPid: Number(value?.parentPid ?? value?.ParentProcessId ?? 0),
+        startMarker: String(value?.startMarker ?? value?.CreationDate ?? '').trim(),
+        startOrder: String(value?.startOrder ?? value?.CreationUtcTicks ?? '').trim(),
+        depth: Math.max(0, Math.trunc(Number(value?.depth || 0)))
+    };
+    if (!Number.isInteger(record.pid)
+        || record.pid <= 1
+        || !Number.isInteger(record.parentPid)
+        || record.parentPid < 0
+        || !record.startMarker
+        || !/^\d+$/.test(record.startOrder)
+        || !Number.isFinite(record.depth)) {
+        return null;
+    }
+    return record;
+}
+
+function normalizeRecords(values) {
+    if (!Array.isArray(values)) return null;
+    const records = values.map(normalizeRecord);
+    if (records.some(record => !record)) return null;
+    const unique = new Map();
+    for (const record of records) {
+        unique.set(`${record.pid}:${record.startOrder}`, record);
+    }
+    return [...unique.values()];
+}
+
+function writeJsonAtomic(path, value) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporaryPath = `${path}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+    let published = false;
+    try {
+        writeFileSync(temporaryPath, JSON.stringify(value, null, 2), {
+            encoding: 'utf8',
+            mode: 0o600,
+            flag: 'wx'
+        });
+        renameSync(temporaryPath, path);
+        // Existing state directories can have been created by older versions;
+        // enforce the owner-only contract after every atomic replacement too.
+        try { chmodSync(path, 0o600); } catch { /* Windows ACLs remain authoritative */ }
+        published = true;
+    } finally {
+        if (!published) {
+            try { unlinkSync(temporaryPath); } catch { /* temporary file was never published */ }
+        }
+    }
+}
+
+export function getWindowsOwnedProcessManifestPath(
+    stateDir = join(os.homedir(), '.livedesk')
+) {
+    return join(stateDir, WINDOWS_OWNED_PROCESS_MANIFEST_FILE_NAME);
+}
+
+/**
+ * Publishes one immutable launcher generation and all exact Agent records.
+ * Every record retains PID + full-precision CreationDate ticks so a later
+ * launcher can harmlessly ignore a PID that has since been reused.
+ */
+export function writeWindowsOwnedProcessManifest({
+    stateDir,
+    owner,
+    records,
+    now
+} = {}) {
+    const exactOwner = normalizeOwner(owner);
+    const exactRecords = normalizeRecords(records);
+    const nowMs = resolveNow(now);
+    if (!exactOwner) {
+        return {
+            ok: false,
+            error: resultError('An exact Windows LiveDesk launcher owner is required.')
+        };
+    }
+    if (!exactRecords) {
+        return {
+            ok: false,
+            error: resultError('Every Windows LiveDesk process record requires exact PID and CreationDate identity.')
+        };
+    }
+    if (!Number.isFinite(nowMs)) {
+        return { ok: false, error: resultError('A valid manifest publication time is required.') };
+    }
+    const path = getWindowsOwnedProcessManifestPath(stateDir);
+    const updatedAt = new Date(nowMs).toISOString();
+    try {
+        writeJsonAtomic(path, {
+            protocolVersion: WINDOWS_OWNED_PROCESS_MANIFEST_VERSION,
+            owner: exactOwner,
+            updatedAt,
+            records: exactRecords
+        });
+        return { ok: true, path, records: exactRecords, updatedAt };
+    } catch (error) {
+        return { ok: false, path, records: [], error };
+    }
+}
+
+/**
+ * Reads only a fresh manifest belonging to the exact runtime-lock generation.
+ * Owner mismatch, malformed identity, expiry, and PID reuse all fail closed.
+ */
+export function readWindowsOwnedProcessManifest({
+    stateDir,
+    owner,
+    maxAgeMs = DEFAULT_WINDOWS_OWNED_PROCESS_MANIFEST_MAX_AGE_MS,
+    now
+} = {}) {
+    const exactOwner = normalizeOwner(owner);
+    const nowMs = resolveNow(now);
+    const maximumAge = Number(maxAgeMs);
+    const path = getWindowsOwnedProcessManifestPath(stateDir);
+    if (!exactOwner) {
+        return {
+            ok: false,
+            records: [],
+            error: resultError('An exact Windows LiveDesk launcher owner is required.')
+        };
+    }
+    if (!Number.isFinite(nowMs)
+        || !Number.isFinite(maximumAge)
+        || maximumAge < 0) {
+        return {
+            ok: false,
+            records: [],
+            error: resultError('A valid manifest time and maximum age are required.')
+        };
+    }
+
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    } catch (error) {
+        return { ok: false, records: [], error };
+    }
+    const updatedAt = String(parsed?.updatedAt || '');
+    const updatedAtMs = Date.parse(updatedAt);
+    if (parsed?.protocolVersion !== WINDOWS_OWNED_PROCESS_MANIFEST_VERSION) {
+        return {
+            ok: false,
+            records: [],
+            updatedAt,
+            error: resultError('Unsupported Windows LiveDesk process-manifest version.')
+        };
+    }
+    if (!ownersMatch(parsed?.owner, exactOwner)) {
+        return {
+            ok: false,
+            records: [],
+            updatedAt,
+            error: resultError('Windows LiveDesk process manifest belongs to another launcher generation.')
+        };
+    }
+    if (!Number.isFinite(updatedAtMs)
+        || updatedAtMs > nowMs + MAX_FUTURE_CLOCK_SKEW_MS
+        || nowMs - updatedAtMs > maximumAge) {
+        return {
+            ok: false,
+            records: [],
+            updatedAt,
+            error: resultError('Windows LiveDesk process manifest is stale or has an invalid timestamp.')
+        };
+    }
+    const exactRecords = normalizeRecords(parsed?.records);
+    if (!exactRecords) {
+        return {
+            ok: false,
+            records: [],
+            updatedAt,
+            error: resultError('Windows LiveDesk process manifest contains an invalid process identity.')
+        };
+    }
+    return { ok: true, records: exactRecords, updatedAt };
+}